Z.ai has released the weights for GLM-5.3, its frontier coding model, on Hugging Face. The launch blog post from mid-August promised the weights two weeks after launch, once safety evaluation and hardening finished, and that window has now closed. What makes this release unusual is not the benchmark table, though the numbers are strong. It is where the model’s capability grew fastest: finding and exploiting security vulnerabilities.
Same base, better training
GLM-5.3 uses the same base model as GLM-5.2. Every improvement comes from post-training. Z.ai scaled its reinforcement learning pipeline on the stack it built for the previous release: the slime framework for asynchronous RL training, SAO for long-horizon tasks, and a large and growing set of task environments that now include multi-day engineering work rather than single-shot coding exercises.
The results show up most clearly in agentic coding. Terminal Bench 3.0 went from 4.6 to 28.3, DeepSWE v1.1 from 46.2 to 66.9, and the model posts a 50% improvement over GLM-5.2 on Z.ai’s in-house Code Bench. Token efficiency improved alongside accuracy: at max effort, GLM-5.3 reaches 34.5% task completion while emitting roughly 75K output tokens per task, compared with GLM-5.2’s 23.4% at 96K. At high effort it edges past Claude Opus 4.8 (31.4% at about 50K tokens versus 29.5% at 120K), though Claude Fable 5 still leads the closed models at 39.5% on that measure.
The cyber capability surprise
The part Z.ai itself flagged as unexpected is the model’s performance on security benchmarks. CyberGym, which tests vulnerability discovery from white-box source code, now sits at 84.5%, the best published result and ahead of GPT-5.6 Sol at 83.6%. On ExploitBench, which requires reasoning through complete exploitation chains rather than spotting isolated flaws, GLM-5.3 more than doubled GLM-5.2, scoring 54.4% against 24.4%.
Z.ai is candid about the pattern: gains get larger the further up the exploitation chain you go, and so does the remaining gap to closed frontier models. On ExploitGym the model completed 105 tasks in two hours and 130 in six, against 29 and 39 for GLM-5.2, while Fable 5 and GPT-5.6 Sol remain well ahead. Capability is growing fastest exactly where the open-weight model is furthest behind.
2,436 real-world vulnerabilities
Benchmark claims are cheap, so the more interesting disclosure is what the model found outside controlled tests. Working with several security teams in China since the GLM-5.2 era, Z.ai ran the model against real production codebases. After expert review and deduplication, it identified 2,436 vulnerabilities across 269 projects, including 1,097 rated medium-to-high severity. The findings span kernels, browser engines, open-source infrastructure, and network protocols. The oldest flaw dated back to 1981, and on average a vulnerability lived 26.6 years before the model found it.
Z.ai has published a Security Disclosure Ledger tracking the process: 53 findings are public, 2,383 remain under embargo. That is a large pending disclosure backlog, and how Z.ai handles coordinated disclosure at this scale will be worth watching. A batch release of hundreds of kernel and browser bugs would stress every downstream patching process in the ecosystem.
What this means for security teams
Two practical takeaways. First, automated vulnerability discovery at this capability level is now available to anyone who can run a large model. The same tooling that finds genuine bugs will find them maliciously, and defenders should assume their codebases are being scanned by models of roughly this class. Prioritizing patch velocity matters more than it did last year.
Second, the defensive applications are real. Organizations with large legacy code estates now have a credible automated option for the audit work that human security teams never have time to finish. The disclosure ledger model, where findings are tracked publicly through the disclosure process, is a reasonable template for how that work should be documented.
The environment bet
The part of this release with the longest shadow is not the benchmark table but the method. Z.ai describes pipelines that synthesize RL environments end to end: research agents collect task patterns from real engineering work, turn them into runnable long-horizon environments with hidden state and multi-step dependencies, and judge agents verify each task is solvable before it enters training. Verifiers are built without access to reference solutions and checked against oracle, no-op, and unsolved states before their reward signal is trusted.
This matters because environment construction was the bottleneck limiting RL on agentic tasks. If synthetic environments can be generated and verified at scale, post-training gains stop being constrained by human curriculum design, which is exactly the bet this release pays out on. Z.ai notes the pipelines still need meaningful human-in-the-loop work, and full autonomy is a stated next step. Other labs are racing down the same path, which suggests the gap between open-weight and closed models will keep narrowing on agentic benchmarks even if raw model scale stays constant.
Deployment notes
For teams planning to run GLM-5.3: the API no longer supports disabling thinking. Three effort levels are available (low, high, max), with max recommended for coding work and default behavior always on. The blog also documents a 2.3x throughput improvement in the training stack that made this release economical to produce, which signals that Z.ai intends to keep iterating on post-training rather than waiting for a new base model. Given that the entire gain here came from RL on better environments, the next release may follow the same pattern.